We Know WordPress Sucks. Now PHP Sucks Too? Don't Let Them Destroy Your Business.

Bob didn't touch his website this week. He was on a job every day. He already knows WordPress has its problems, because every few months his web guy tells him a plugin needs updating. He figures that's the whole deal.

What nobody told Bob is that WordPress sits on top of something else. It's called PHP, and it's the software that builds his pages every time somebody visits. On October 21, the people who make PHP rushed out an emergency fix for two holes in it. A stranger could get onto the computer running Bob's site with no password. Nothing for Bob to click.

I've been telling you WordPress sucks for years. The plugins. The updates. The bill that never stops. Then in July, a hole in WordPress itself let strangers in with no password. Now go one floor down. PHP just cracked too.

Here's the part nobody explains to you. Your website isn't one thing. It's a stack. The computer it lives on, PHP, WordPress, your theme, every plugin. Each layer is a door, and every one of them is yours to keep shut. Two minutes below tells you how many you've got.

TL;DR

PHP is the behind the scenes software under every WordPress site, and about 69% of websites use it (Wikipedia, 2026). On October 21, 2026, its makers fixed two holes that let a stranger run code on the computer behind a website with one request and no password (Help Net Security, 2026). A WordPress site is a stack: the computer it lives on, PHP, WordPress, your theme and your plugins. Each one is a door somebody has to keep fixed. Ask your host one question this week: is the October 21 PHP fix on my site?

3 Things to Remember

Your Website Is a Stack. Every Layer Is a Door.

Here's your website in plain words. On your phone it looks like one thing. Underneath, it's five or more pieces of software stacked on top of each other. Any one of them can be broken into on its own.

Start at the bottom. There's the computer your host rents you, where the site lives. On that runs PHP, the software that builds your pages. WordPress sits on PHP. Your theme sits on WordPress. Then every plugin you or your web guy ever installed sits on top of all of it.

You see one website. A stranger trying to get in sees a stack, and goes looking for the weakest layer. That's the whole game.

For years the fight was at the top of the stack, in the plugins. I've written plenty about why WordPress sucks for a small business. PHP2Shell went after the bottom instead. When the floor cracks, it doesn't matter how nice the furniture is.

Mistake: you think your website is one thing you bought once.

Fix: write down every layer it runs on, bottom to top.

Payoff: you finally know what you're on the hook for. It's a longer list than anybody told you.

PHP Got Cracked. That's the Floor Under WordPress.

PHP2Shell is the name for two holes in PHP itself. Not in a plugin. Not in a theme. In the software every one of those layers stands on.

The makers of PHP rated it 9.2 out of 10. One security company gave it a full 10 (Help Net Security, 2026). That's about as bad as the scale goes.

Here's what that means in plain words. A stranger sends one request to the computer running your site. No login. No password. Nothing for you to click. Then they can run whatever they want on it (Help Net Security, 2026).

Sit with that. Your security plugin is one of the layers on top, and a hole in the floor doesn't care what's sitting on it. It worked on the newest version of WordPress too (Patchstack, 2026). Keeping WordPress current didn't save anybody this time.

And this isn't some small corner of the internet. About 69% of websites use PHP. These holes sat in it for years, and AI is what made them easy to use (Wikipedia, 2026). Old code. New tools. That's the world your site lives in now.

Mistake: you trust the stuff under WordPress because it's old and everybody uses it.

Fix: treat PHP like any other layer. Know who keeps it fixed.

Payoff: when the next one drops, one email tells you whether you're open.

Every Door Has a Different Guy Holding the Patch.

Here's the part that should land. Each layer of a WordPress site gets fixed by somebody different, on their own clock. And you're the one who has to make sure all of it actually happened.

• The computer it lives on: your host.
• PHP: your host, or you from your host's dashboard. Depends on the plan.
• WordPress: WordPress sends the fix. Somebody on your side makes sure it took.
• Your theme: the theme company sends it. You click update.
• Every plugin: a different company each, on its own schedule. You click update, one at a time.

Say you run 20 plugins. That's 20 companies you've never met, plus the theme company, plus WordPress, plus your host. 23 different clocks, and you're the one checking all of them.

The attackers didn't wait on any of those clocks. They got going the morning of October 21, the same day the fix came out (Patchstack, 2026).

Governments didn't wait either. Finland pulled its public government websites. The Netherlands pulled its main government portal and the login its people use for government services. France took down every Interior Ministry website. Denmark shut down its national school platform. Even Drupal.org, home of one of the big website platforms, went offline to put the fix on (Wikipedia, 2026; Patchstack, 2026).

The NSA told sites that couldn't update right away to go offline. The UK said the same thing (Help Net Security, 2026). Those governments have security teams and people whose whole job is watching for this. They still pulled the plug. You've got a crew to run and a web guy who answers sometimes.

Mistake: you assume somebody is watching every layer.

Fix: ask your host this week whether the October 21 PHP fix is on your site.

Payoff: one email and you know where the biggest door stands.

I run a [TYPE OF BUSINESS] in [YOUR CITY]. My website runs on
[WORDPRESS, OR WHATEVER YOU THINK IT RUNS ON] and my web host is
[HOST NAME].

Here is my plugin list from the Plugins screen, one per line:
[PASTE YOUR PLUGIN LIST, OR WRITE NONE]

Do three things.

1. List every layer my site likely runs on, bottom to top: the
   computer it lives on, PHP, WordPress, the theme, and each
   plugin. For each layer, tell me who is supposed to fix it:
   my host, WordPress, the theme company, the plugin company, or me.
2. Count the layers. Call each one a door. Give me the total.
3. Write a short, friendly email to my web host. Ask which PHP
   version my site is on, whether the October 21, 2026 PHP fix
   is on it, and if I am on PHP 8.1 or older, what it takes to
   move up.

Rules: write at a 5th grade reading level. Short sentences. No
jargon. If you are not sure about something, say you are not sure.

Old PHP Is a Door Nobody Is Coming to Fix.

Here's the good news first. The fix is out, and it's not on you to install it. It's on whoever runs the computer your site lives on. For most people that's the web host, the company you pay every month or every year to keep the site up.

So send them one email. Ask which PHP version your site is on, and whether the October 21 fix is on it. You want a straight answer back, in writing. Not a maybe.

If they tell you 8.1 or older, that's the door nobody is coming to fix. Those old versions are past their expiration date and didn't get a normal release for this one (Wordify, 2026). The clean move is up. Not a patch. Up.

If your site sits behind Cloudflare, they put up a shield for this one, free accounts included (Help Net Security, 2026). Good. That buys you time. It doesn't replace the fix.

So get on a fixed version, then get somebody to keep you there. That second part is the one that slips.

Mistake: you leave PHP on whatever version the site launched with.

Fix: ask your host to put you on a current version with the October 21 fix. On 8.1 or older, move up.

Payoff: you're not one of the 884,000 anymore.

I Left the Stack. PHP2Shell Had Nothing to Hit.

I didn't write this from the cheap seats. I ran my own business on WordPress for years, which means PHP was under my site too. I know every layer of that stack because I built on it for a long time. Then I moved 1,387 of my own posts off it.

Everything I build now is an AI-JSX site. 281 of them so far. None of them run PHP. So when this news broke, there was nothing on those sites for it to hit, and nothing to patch. Not because I'm any sharper than you. Because there's nothing there for it to be about.

If you want the plain version first, here's what an AI site actually is. And here's how moving 1,387 posts off WordPress went, rankings and all.

When a PHP Site Is Fine. And Where Mine Isn't Done.

I'll give credit where it's due, and you should weigh it before you take my side. PHP runs most of the web and it has for decades. When this came out, its makers shipped a fix fast. Cloudflare put up a shield for everybody, free accounts included (Help Net Security, 2026). That's people doing their jobs, and doing them quick.

If your host put the fix on, your PHP is current, your plugin list is short and somebody real watches the site, you're in decent shape. Close the tab and go run your business.

And fair is fair on my side too. An AI-JSX site has fewer doors, not zero. The code it's built on still gets updates, and the host still keeps its own computers fixed. So every site still needs a builder keeping it current. Mine included. That's my job, and I do it. The difference is a much shorter list, and no PHP under it.

Now the turn. It took an emergency fix, governments going dark, and the NSA telling people to unplug, all to close one hole in one layer. A WordPress site has a whole stack of them. Plugins, theme, WordPress itself, all updating on their own schedule, forever, on your site.

Count Your Doors Before Somebody Else Does.

WordPress sucks. Now PHP sucks too. The stack under your site is getting hit from the top and the bottom, and you're the one holding it up.

You didn't get into business to count software layers. You got into it to do the work and get paid. So know your layers. Send your host one email. Get off old PHP if you're on it.

Or shorten the stack. That's the whole idea behind the 100K Site. No PHP under it, no plugin pile on top, and you're not the one on patch duty.

Want to see what that feels like, built for your own business? Take a test drive. I'll put your site on my code, and you look at it before you spend a dime.

Take a Test Drive →

FAQ

Read These In This Order

1. WTF Is PHP? Your Website Runs on It.
2. Governments Shut Down Their Own Websites. PHP Is Hacked.
3. No Password Needed. Your WordPress Site Is an Open Door.
4. Every WordPress Site Needed an Emergency Fix. Here's Why My Sites Didn't.
5. LMAO! WordPress Got Hacked Again. Is Your Site One of Them?
6. Leaving WordPress Sounds Like Hell. I Moved 1,387 Posts